We tested CVE-2025-56566, which reports the clear-text storage of sensitive information (CWE-312/CWE-316) in non-volatile memory. The goal was to confirm whether credentials for external services and network state data could be recovered from a raw disk dump without authentication, and to verify if the issue was resolved in more recent versions.
The verification was conducted on a MikroTik Cloud Hosted Router (CHR) in a QEMU/KVM environment. We used two versions of RouterOS: 7.19.4 (cited in the advisory) and 7.24.5 (the latest stable version at the time of the test). The disk image was converted to raw format for analysis. The network was isolated, with SSH access via port-forwarding for configuration. To identify credentials in the dump, we used unique markers (e.g., MARKER-EMAIL-PwD-7731).
This content is reserved for those in the dojo.
Entry is free: you subscribe to the newsletter with your email and then choose to join the dojo, without a password. How it works
